What is the CVSS score of CVE-2026-10104?

CVE-2026-10104 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Product Video Gallery WooCommerce CVE-2026-10104

EUVD-2026-41269 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Wordfence

GHSA-rv7q-hqv4-5324

WordPress XSS Wordpress Plugin Product Video Gallery For Woocommerce

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory shop manager auth; UI:R reflects victim must visit page; AC:L because injection itself is straightforward once authenticated.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:18 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Product Video Gallery for WooCommerce WordPress plugin (versions ≤ 1.5.1.8) allows authenticated shop managers to persist malicious JavaScript via the custom_thumbnail parameter, which then executes in the browsers of any visitor accessing an affected product page. The CVSS scope-change flag (S:C) confirms the injected payload crosses security boundaries from the attacker's session into victims' browser contexts. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog, but the PR:H requirement is the primary limiting factor for real-world risk - any compromise of a shop manager account would make this trivially exploitable.

Technical ContextAI

This vulnerability affects the Product Video Gallery for WooCommerce WordPress plugin (CPE: cpe:2.3:a:nikhilgadhiya:product_video_gallery_for_woocommerce:*:*:*:*:*:*:*:*) by developer nikhilgadhiya. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the plugin fails to apply sufficient input sanitization when the custom_thumbnail parameter is received, and fails to apply appropriate output escaping when that value is later rendered in the page. The vulnerable code paths are documented in the plugin's SVN repository at public/class-rendering.php (lines 365 and 379) and admin/class-video-field.php (line 310) - both the front-end rendering class and the admin video-field handler fail to properly handle this parameter. Since WooCommerce product gallery pages are typically public-facing, the stored payload is served to every unauthenticated visitor who loads the affected product page, making this a stored (persistent) rather than reflected XSS, with substantially broader victim reach.

RemediationAI

A patch commit has been recorded in the plugin's SVN repository (changeset 3591727 per the reference at plugins.trac.wordpress.org), indicating an upstream fix exists; however, the exact patched release version number is not independently confirmed from the available data - administrators should update to the latest available version beyond 1.5.1.8 via the WordPress plugin repository and verify the changelog. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f61885bc-b7da-42b8-a0d3-ba5d7d19b536 should be consulted for confirmed fix version details. If immediate patching is not possible, the primary compensating control is to audit and restrict which accounts hold shop manager or administrator roles, reducing the number of users who could inject malicious content. Additionally, a Web Application Firewall with XSS ruleset (such as Wordfence's own WAF) can detect and block XSS payloads at the perimeter, though this does not address the root sanitization deficiency and should not substitute for patching.